CVE-2022-26659

Docker Desktop installer on Windows in versions before 4.6.0 allows an attacker to overwrite any administrator writable files by creating a symlink in place of where the installer writes its log file. Starting from version 4.6.0, the Docker Desktop installer, when run elevated, will write its log files to a location not writable by non-administrator users.

• CWE-59

• https://docs.docker.com/desktop/windows/release-notes/Release Notes, Vendor Advisory
• https://docs.docker.com/docker-for-windows/release-notes/Release Notes, Vendor Advisory
• https://github.com/hmnthabit/Advisories/blob/master/CVE-2022-26659.mdThird Party Advisory
• https://docs.docker.com/desktop/windows/release-notes/Release Notes, Vendor Advisory
• https://docs.docker.com/docker-for-windows/release-notes/Release Notes, Vendor Advisory
• https://github.com/hmnthabit/Advisories/blob/master/CVE-2022-26659.mdThird Party Advisory

Published

Mar 25, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26652NATS nats-server before 2.7.4 allows Directory Traversal (wi…6.5
• CVE-2022-26653Zoho ManageEngine Remote Access Plus before 10.1.2137.15 all…5.3
• CVE-2022-26654Pexip Infinity before 27.3 allows remote attackers to force …7.5
• CVE-2022-26655Pexip Infinity 27.x before 27.3 has Improper Input Validatio…7.5
• CVE-2022-26656Pexip Infinity before 27.3 allows remote attackers to trigge…8.2
• CVE-2022-26657Pexip Infinity before 27.3 allows remote attackers to trigge…7.5
• CVE-2022-2666A vulnerability has been found in SourceCodester Loan Manage…9.8
• CVE-2022-26660RunAsSpc 4.0 uses a universal and recoverable encryption key…7.5
• CVE-2022-26661An XXE issue was discovered in Tryton Application Platform (…6.5
• CVE-2022-26662An XML Entity Expansion (XEE) issue was discovered in Tryton…7.5
• CVE-2022-26665An Insecure Direct Object Reference issue exists in the Tyle…7.5
• CVE-2022-26666Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8